There is a setting in Windows Registry that affects all the forensic tools, not just smartphones, that can create a discrepancy relating to timestamps on files.

In order to prevent this issue:

  • Go to HKEY_CURRENT-USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced

  • Zoom Out and Create a new DWORD (32-bit Value)

  • Rename it to “ShowSecondsinSystemClock”

  • Change the Value Data to 1

  • Restart the forensic workstation

From here, all your tools should now be showing seconds for date/time stamps. 

Share this post